Description
A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload in the "admin" parameter under the "Manage administrators" module.
Remediation
References
Related Vulnerabilities
TYPO3 Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2025-59018)
MySQL CVE-2022-21334 Vulnerability (CVE-2022-21334)
Liferay Portal Deserialization of Untrusted Data Vulnerability (CVE-2020-15842)
TYPO3 Uncontrolled Recursion Vulnerability (CVE-2022-23500)
Chamilo Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2026-29041)